Abstract: Embodiments disclosed herein seamlessly integrate several components into a comprehensive collusion detection and traffic quality prediction system, including a strong modeling module for processing historical click data and transforming potential collusions hidden therein into solvable graph partitioning (network) and/or vector space clustering (pattern) models, a scalable and robust toolkit comprising a plurality of graph partitioning and clustering heuristics for analyzing and generating high density subgraphs and high dimensional clusters or groups, and a post processing module for extracting entities from the subgraphs and clusters and placing them on global block lists. Entities thus listed can be blocked from client networks in real time. As such, high traffic quality can be predicted. A job scheduler may schedule individual jobs from the modeling module based on the number of available resources in a distributed computing environment to minimize completion time while balancing load.

Abstract: Embodiments disclosed herein provide a practical solution for click fraud detection. One embodiment of a method may comprise constructing representations of entities via a graph network framework. The representations, graphs or vector spaces, may capture information pertaining to clicks by botnets/click farms. To detect click fraud, each representation may be analyzed in the context of clustering, resulting in large data sets with respect to time, frequency, or gap between clicks. Highly accurate and highly scalable heuristics may be developed/applied to identify IP addresses that indicate potential collusion.